GCP OIDC Authentication for Harness

This repository contains Terraform configuration to set up secure, keyless authentication from Harness CI/CD pipelines to Google Cloud Platform using OpenID Connect (OIDC) and Workload Identity Federation.

What This Does

This setup eliminates the need to store GCP service account keys in Harness by using OIDC tokens for authentication. It creates:

1. GCS Bucket - A Google Cloud Storage bucket for file uploads
2. Service Account - A GCP service account with permissions to manage objects in the bucket
3. Workload Identity Pool - Allows external identities (Harness) to authenticate to GCP
4. Workload Identity Provider - Configures the OIDC trust relationship with Harness
5. IAM Bindings - Grants the Harness identity permission to impersonate the service account

Benefits

• No stored credentials - No service account keys to manage or rotate
• Better security - Short-lived tokens instead of long-lived keys
• Automatic rotation - Tokens are automatically generated and expired
• Audit trail - All access is logged and traceable to specific Harness pipelines

Prerequisites

• GCP project with billing enabled
• Terraform >= 1.0 installed
• gcloud CLI installed and authenticated
• Harness account with a project set up
• Appropriate GCP permissions to create:
  • Storage buckets
  • Service accounts
  • Workload identity pools/providers
  • IAM bindings

Setup Instructions

1. Configure Variables

Copy terraform.tfvars and update the values:

project_id         = "your-gcp-project-id"
region             = "europe-west2"
bucket_name        = "your-unique-bucket-name"
harness_account_id = "your-harness-account-id"

To find your Harness Account ID:

• Log into Harness
• Go to Account Settings → Overview
• Copy the Account ID

2. Enable Required GCP APIs

gcloud services enable iamcredentials.googleapis.com
gcloud services enable sts.googleapis.com
gcloud services enable storage.googleapis.com

3. Run Terraform

# Initialize Terraform
terraform init

# Preview the changes
terraform plan

# Apply the configuration
terraform apply

4. Configure Harness GCP Connector

After Terraform completes, it will output the configuration you need. Use these values to create a GCP Connector in Harness:

1. In Harness, go to Project Settings → Connectors → New Connector
2. Select Google Cloud Platform
3. Choose Use Workload Identity Federation
4. Enter the values from Terraform outputs:
   • Workload Identity Provider: projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/harness-pool/providers/harness-provider
   • Service Account Email: oidc-upload-sa@PROJECT_ID.iam.gserviceaccount.com
   • Project ID: Your GCP project ID
5. Save the connector (use ID: GCS_upload_by_OIDC_TF to match the example pipeline)
6. Test the connection

5. Use in Your Pipeline

The repository includes an example pipeline at .harness/pipelines/pipeline.yaml that demonstrates:

• Creating a test file
• Uploading it to GCS using the OIDC-authenticated connector

To use the connector in your own pipelines:

- step:
    identifier: upload_to_gcs
    name: Upload to GCS
    type: GCSUpload
    spec:
      connectorRef: GCS_upload_by_OIDC_TF
      bucket: your-bucket-name
      sourcePath: /path/to/file
      target: /destination/path

Repository Structure

.
├── main.tf                    # Main Terraform resources
├── variables.tf               # Variable definitions
├── outputs.tf                 # Output definitions
├── terraform.tfvars           # Your configuration values
├── .gitignore                # Ignores sensitive Terraform files
├── .harness/
│   └── pipelines/
│       └── pipeline.yaml      # Example Harness pipeline
└── README.md                  # This file

Security Notes

• The .gitignore file excludes sensitive Terraform state files and variable files
• Never commit terraform.tfstate or files containing actual credentials
• The service account has minimal permissions (only storage.objectAdmin on the specific bucket)
• Access is restricted to your specific Harness account ID
• Consider adding additional attribute_condition filters for org/project if needed

Bucket Configuration

The GCS bucket is configured with:

• Versioning enabled - Previous versions of files are retained
• Lifecycle rule - Objects older than 30 days are automatically deleted
• Uniform bucket-level access - Consistent IAM permissions across all objects

Adjust these settings in main.tf as needed for your use case.

Troubleshooting

Connection test fails in Harness

1. Verify the Workload Identity Provider path is exactly as shown in Terraform outputs
2. Ensure the service account email is correct
3. Check that the Harness Account ID matches exactly
4. Wait 5-10 minutes after running Terraform for IAM propagation

Permission denied errors

1. Verify the service account has storage.objectAdmin role on the bucket
2. Check that the workload identity user binding is correct
3. Ensure the attribute_condition matches your Harness account ID

Terraform errors

1. Make sure required APIs are enabled (see step 2 above)
2. Verify you have the necessary GCP permissions
3. Check that the bucket name is globally unique

Outputs

After running terraform apply, you'll see:

• bucket_name - The name of your GCS bucket
• service_account_email - The service account email to use in Harness
• workload_identity_provider - The full provider path for Harness configuration
• harness_gcp_connector_config - Step-by-step configuration instructions

Cleanup

To destroy all resources created by Terraform:

terraform destroy

Warning: This will delete the GCS bucket and all its contents (if force_destroy = true).

References

• GCP Workload Identity Federation
• Harness GCP Connector Documentation
• Terraform Google Provider

License

This configuration is provided as-is for educational and development purposes.